Anthropic PBC has restricted the public release of its Mythos AI model after the system demonstrated an unprecedented ability to find software vulnerabilities [1].
The decision highlights a growing tension between AI capabilities and global cybersecurity. If a tool capable of autonomous vulnerability discovery falls into the wrong hands, it could enable hackers to compromise critical infrastructure at scale.
Reports indicate that Mythos discovered more than 2,000 unknown software vulnerabilities within seven weeks of testing [2]. This level of efficiency has sparked alarm among financial regulators and central banks across the U.S. and Canada [3].
While the model is not available to the general public, several major financial institutions are testing the technology internally [4]. These include Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley [4].
There are conflicting reports regarding the extent of the model's availability. Some sources said the model was released despite internal fears [5], while others said Anthropic explicitly deemed the tool too powerful for a general rollout [1].
The company's cautious approach follows warnings from regulators that the tool's ability to autonomously discover flaws could be misused for large-scale cyberattacks [1]. The current limited deployment allows banks to use the tool for defensive security—finding flaws before attackers do—while preventing the public from accessing the same capabilities [4].
This restricted access reflects a broader trend in AI development where "frontier models" are gated based on their potential for dual-use, meaning they can be used for both beneficial and harmful purposes [1].
“Mythos discovered more than 2,000 unknown software vulnerabilities within seven weeks of testing.”
The restricted release of Mythos signals a shift toward 'gated' AI deployment for high-risk capabilities. By providing the tool to major banks while blocking the public, Anthropic is attempting to bolster the defenses of the financial system without providing a roadmap for malicious actors to exploit the same vulnerabilities.
